InfoSecBulletin Cybersecurity for mankind
Chinese-speaking hackers have added Claude, Qwen, and DeepSeek to their hacking system to automate cyberattacks on governments and other targets in Asia, according to a report from the threat intelligence company Hunt.io.
Hunt.io says this operation is different from the campaign seen in July, where a Chinese-speaking operator used Claude Code and DeepSeek in attacks in four countries. The new campaign used AI models. It focused on Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, government and education in mainland China, and businesses in Da Nang, Vietnam.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Hunt.io found five open directories related to the campaign. They connected them using shared tools, like a SOCKS proxy endpoint found in different places. The systems had common SecFlow and GLUTTON items, shared accounts, and a direct link to the second-stage payload.
According to the researchers, a Fengtai District government environment was hit hardest, “where the operator achieved command execution, collected LSASS and registry hives, accessed government and health records, and deployed multiple Windows implants. Separate activity exposed a Chinese education AI platform and obtained root database access to a university campus-card system.”
The attackers accessed into a government Office Automation system that was open to the internet. They did this by using a file management tool that let them upload ASPX files and find web-accessible locations.
This let the hackers use tools on the server inside the app. They later moved a 75.8MB LSASS memory dump with important login details in 37 parts.
They got the SAM and SYSTEM registry files and set up a server page, extract.aspx, that looked for Windows password data. Then they found 822 OA account records and made a new active OA account with higher permissions. The OA storage had 949 attachments that added up to about 1.28GB.
Researchers found that the recovered material had government work and admin info, some health documents, a chronic disease report with patient details, and Windows login data.
